recent attack via phpBB, log files deleted? accessed file system outside /home/

enzo250gto · 12-10-2004, 03:04 PM

My server was recently attacked by some hackers that used an exploit in php and phpBB's forum software.

In this attack the attacker manager to delete all the files from /var/log in addition they took down apache.

Now for my questions. If the linux user "user1" has a website in /home/user1/www and apache is being run by the "apache" user what user is actually accessing the files when it is http://www.site.blah/forum/ ?

How could this user then begin running things outside the /home/ directory?

I was running RedHat 9.

Thanks for the info.

sigsegv · 12-10-2004, 04:55 PM

Apache runs as "apache". Chances are the attecker used the phpBB hole to gain access to the system, then used a local exploit to gain higher access. Generally speaking, people tend to ignore local exploits thinking "My listening daemons are secure, so I don't have to worry about that" ...

This is a good example of why that's not true.

enzo250gto · 12-13-2004, 01:00 PM

Quote:

Originally posted by sigsegv
Apache runs as "apache". Chances are the attecker used the phpBB hole to gain access to the system, then used a local exploit to gain higher access. Generally speaking, people tend to ignore local exploits thinking "My listening daemons are secure, so I don't have to worry about that" ...

This is a good example of why that's not true.

I agree 100% and this is my question. How do I know the local exploits? Once I acknowledge the local exploits how to I plug them up?

Perhaps I need to read a Linux security book?

sigsegv · 12-13-2004, 04:49 PM

While that's a good idea too, you should mostly just watch your distro's security mailing list to see when holes are discovered (I have no idea if Slack has such a thing -- Not used it since v3). Another good list to watch is Bugtraq, or PacketStorm.

tangle · 12-13-2004, 07:58 PM

Here is Slack's office security advisories.
http://www.slackware.com/security/li...ecurity&y=2004

Since Pat is really sick, there are a couple of guys from Brazil that he trusts that are doing security updates. Look here for them.
http://www.slackware.org.br/~patrick...-ChangeLog.txt

cormander · 12-17-2004, 01:49 PM

What I always recomend is a very tight firewall. What hackers like to do, is try to retrieve a backdoor program they can telnet or ssh into. If you're filtering all ports not in use, then they can't do this.

Also, if you reject certian types of outgoing requests, they can't retrieve a hacker program at all. I have a deny-by-default policy, on both incoming and outgoing, and so far, for outgoing, I only have enabled udp to certian IP addresses on port 53 ( my DNS servers ), and port 25 ( to be able to send mail ).

If they try to retrieve something, they will get:

Code:

[corman@localhost corman]$ wget cormander.com
--10:35:30--  http://cormander.com/
           => `index.html'
Resolving cormander.com... done.
Connecting to cormander.com[68.157.128.141]:80... failed: Connection refused.
[corman@localhost corman]$

Also, it is a good idea to symlink /usr/tmp, /var/tmp, and any other world writable directory to /tmp. This makes a single place to look at for hacker-made files. Have a cronjob running, that checks for executable files in /tmp, and alerts you, because you should never have an executable file in there.

-Corey

sigsegv · 12-17-2004, 02:33 PM

Quote:

Originally posted by cormander
What I always recomend is a very tight firewall. What hackers like to do, is try to retrieve a backdoor program they can telnet or ssh into. If you're filtering all ports not in use, then they can't do this.

This isn't true, but is a good idea anyway

Quote:

Originally posted by cormander
If they try to retrieve something, they will get:

Unless they run their rootkit server on tcp 25 of course

Quote:

Originally posted by cormander
... that checks for executable files in /tmp, and alerts you, because you should never have an executable file in there.

This isn't true either, though also not a bad idea. What you should do instead is mount /tmp (and pretty much everything besides /usr) noexec. This is also a nice example of why the all to common trend among Linux distros to put entire fs under one big all encompassing '/' is a stupid idea.

cormander · 12-17-2004, 02:43 PM

Security isn't about having "true" fixes to hack methods, it's about taking more steps to prevent them then the hackers are able to try.

Haven't considered the mounted no-exec before, however. How exactly do you do that? Would I have to create a whole new partition and mount it to /tmp ?

-Corey

sigsegv · 12-17-2004, 02:51 PM

Quote:

Originally posted by cormander
Security isn't about having "true" fixes to hack methods, it's about taking more steps to prevent them then the hackers are able to try.

Quote:

Originally posted by cormander
Haven't considered the mounted no-exec before, however. How exactly do you do that? Would I have to create a whole new partition and mount it to /tmp ?

man mount